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Identity of 'Tech Executive’ in Durham indictment over Alfa Bank’ 
claims revealed 


by Jerry Dunleavy, Justice Department Reporter |&% | September 30, 2021 07:29 PM 
| Updated Sep 30, 2021, 09:45 PM 


Just In The unnamed technology executive from 
special counsel John Durham's most recent 


To save face for indictment, who allegedly hired now-indicted 


Biden, 
Democrats 
scheme to tax 
income that 


lawyer Michael Sussmann and helped push 
claims of a secret backchannel between the 
Trump Organization and Russia's Alfa Bank, has 
been revealed. 


hasn't even 

been earned Rodney Joffe, senior vice president of Neustar, 

yet was identified as "Tech Executive-1" on Thursday 
ina CNN report that said Durham issued more 

When did subpoenas to the high-powered, Democrat- 

obesity become connected law firm Perkins Coie that, until 

the new recently, had employed Sussmann. 

healthy? 


Online sleuths figured out earlier this month 
Gavin Newsom Joffe was likely the unnamed technology 
expresses executive. Alfa Bank, which denied the 
'admiration' for existence of a backchannel, is pursuing 
In-N-Out after subpoenas directed at Neustar and Joffe in its 
chain refuses own civil lawsuit. 


to be 
ipaccimauon The grand jury indictment this month against 
police’ Sussmann centers on a September 2016 


meeting between him and then-FBI General 
Supreme Court Counsel James Baker in which Sussmann 


declines to passed along allegations claiming covert 
block Maine communications between Russia’s Alfa Bank 
vaccine and former President Donald Trump's business. 
mandate for Although Durham alleged Sussmann told Baker 
healthcare ; ae 

he was not working for any specific client, the 
workers 


special counsel contends Sussmann was 


: ,_ secretly doing the bidding of former Secretary 
Hunter Biden's } } ; ; ; 
of State Hillary Clinton’s presidential campaign 


art dealer d billing h ign for it I| 
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er working on behalf of Joffe. 
paintings, 
priced up to Joffe features prominently in the criminal case 
500K, will be against Sussmann, who denies any 
cheap’ in 10 wrongdoing. 
years 


“Sussmann’s statement to the FBI General 
Harris lobbies Counsel that he was not acting on behalf of any 
mayors on client was knowingly and intentionally false. In 
reconciliation truth and in fact, and as Sussmann well knew, 
package after Sussmann acted on behalf of and in 
Biden skips coordination with two specific clients of Law 
town Firm-l, i.e., Tech Executive-]1 and the Clinton 

Campaign, in assembling and conveying these 
No spin zone? = allegations. In particular, and as also alleged 


Podium above, Tech Executive-1 consulted and relied on 
pressures Sussmann as his lawyer to assist in 
mount © disseminating the Russian Bank-1 allegations," 


the indictment says. 
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tentatively offered the top [cybersecurity] job by 
the Democrats when it looked like they'd win. | 
definitely would not take the job under Trump." 


Sussmann, a high-profile Washington, D.C. 
cybersecurity lawyer and Justice Department 
veteran who assisted the Democratic National 
Committee dealing with Russian cybertheft 
targeting Democratic emails earlier in 2016, 
pleaded not guilty to a charge of lying to the FBI 
in D.C. federal court. 


Durham noted Joffe initially hired Sussmann in 
February 2015 “in connection with a matter 
involving an agency of the U.S. government,” 
and Sussmann “frequently served as outside 
counsel to Internet Company-], which was a 
significant source of revenue” for himself and 
Perkins Coie. Durham said Joffe served as 
Sussmann’s “primary point of contact at 
Internet Company-1” during the relevant 2016 
and 2017 time frame. 


Durham said a computer researcher who goes 
by the moniker “Tea Leaves” — dubbed 
“Originator 1” in the indictment — was a 
“business associate” of Joffe’s and “assembled 
purported DNS data reflecting apparent DNS 
lookups between” Alfa Bank and an alleged 
Trump Organization email domain, with data 
spanning early May to late July 2016. Durham 
said Joffe “and others” were in possession of the 
“Russian Bank Data” by July 2016. 


Joffe alerted Sussmann about the Alfa Bank 
claims by July 2016, Durham said, and “over the 
ensuing weeks, and as part of their lawyer-client 
relationship,” Sussmann and Joffe “engaged in 
efforts with Campaign Lawyer-1” — identifiable 
as former Perkins Coie lawyer and Clinton 
campaign general counsel. 


“Individuals acting on behalf of the Clinton 
Campaign to share information about the 
Russian Bank Data with the media and others, 
claiming that it demonstrated the existence of a 
secret Communications channel between the 
Trump Organization and Russian Bank-1," 
according to the report. 


Clinton tweeted about the Alfa Bank allegations 
in the closing days of the 2016 race on 
Halloween. 


“Computer scientists have apparently 
uncovered a covert server linking the Trump 
Organization to a Russian-based bank," she said. 


Clinton also shared a statement from Jake 


Sullivan, her foreign policy adviser who is now 
President Joe Biden's national security adviser, 
on "New Report Exposing Trump's Secret Line 
of Communication to Russia.” 


between a server registered to the Trump 
Organization and two servers registered to an 
entity called Alfa Bank.” The New York Times 
then published a report that stated, “The FBI 
ultimately concluded that there could be an 
innocuous explanation, like a marketing email 
or spam, for the computer contacts.” 


DOJ Inspector General Michael Horowitz said_in 
his December 2019 report on the Russia 
investigation the FBI "concluded by early 
February 2017 that there were no such links” 
between Alfa Bank and the Trump 
Organization. Horowitz also criticized the FBI for 
17 “significant errors or omissions,” including 
reliance on British ex-spy Christopher Steele’s 
dossier. That research was funded by the 
Clinton campaign through Fusion GPS, hired by 
Marc Elias, who was a Perkins Coie lawyer and 
general counsel for Clinton's presidential 
campaign. 


A bipartisan Senate Intelligence Committee 
report_in 2020 did not find "covert 
communications between Alfa Bank and Trump 
Organization personnel." 


“Rodney Joffe is a globally recognized pioneer 
and preeminent cybersecurity expert who has 
always acted in a professional and apolitical 
manner," Steve Tyrrell, an attorney for Joffe, told 
the Washington Examiner. "For over 15 years, he 
has deployed his expertise on behalf of U.S. law 
enforcement and intelligence agencies and 
continues to be an invaluable partner in their 
efforts to protect the United States and its 
people.” 


The indictment said Sussmann, Joffe, and Elias 
“coordinated and communicated about the 
Russian Bank-1 allegations during telephone 
calls and meetings, which Sussmann billed to 
the Clinton Campaign” from late July through 
mid-August 2016. 


Sussmann, Joffe, and Elias met in a Perkins Coie 
office on Aug. 12, 2016, with Sussmann billing 
the meeting to the Clinton campaign, 
according to records cited in the indictment. 
The special counsel said the trio conducted 
another conference call, also billed to the 
Clinton campaign, the next day. 


Sussmann and Elias held an in-person meeting 
on Aug. 19, 2016, which Durham said 
Sussmann’s calendar labeled as a “Meeting with 
Rodney” and that he once again billed to 
Clinton’s campaign. 


Durham also said Joffe “exchanged emails with 
personnel from the U.S. Investigative Firm” — 
identifiable as Fusion GPS — later in August 
2016. 


Monday meeting with Baker — Sussmann 
“continued to work on disseminating the 
Russian Bank-] allegations on behalf of Tech 
Executive 1 and the Clinton Campaign, and 
continued to bill his work to the campaign.” 


Ultimately, Sussmann billed his meeting with 
Baker to the Clinton campaign as “work and 
communications regarding confidential 
project." 


CLICK HERE TO READ MORE FROM THE 
WASHINGTON EXAMINER 


Joffe’s lawyer said the indictment against 
Sussmann "is full of cherry-picked portions of 
emails and gratuitously presents an incomplete 
and misleading picture of his actions and role in 
the events in question." 


"Mr. Joffe stands behind the rigorous research 
and analysis that was conducted, culminating 
in the report he felt was his patriotic duty to 
share with the FBI. He had had a pre-existing 
relationship with Mr. Sussmann involving 
unrelated matters and sought his advice, 
having no idea his firm represented the Clinton 
campaign," Tyrrell added. 


The New York Times published a report on 
Thursday that revealed the names of other 
people in the orbit of the Alfa Bank-related 
indictment. 


“ 


The indictment’s “Researcher-1” was identified 
as Manos Antonakakis, a computer scientist at 
Georgia Tech. “Researcher-2” is David Dagon, a 
data scientist at the Georgia Institute of 
Technology.“Originator-1” is April Lorenzen, the 
chief data scientist at the Zetalytics information 


services firm. 


Durham said in August 2016 a federal 
government agency “was in the process of 
finalizing, but had not yet signed, a 
cybersecurity research contract with” a school. 


"The primary purpose of the Agency-] Contract 
was for University-| researchers to receive and 
analyze large quantities of public and non- 
public data (including DNS data) from various 
Internet companies in order to identify the 
perpetrators of malicious cyber-attacks and 
protect U.S. national security,” the indictment 
said. 


Joffe “tasked” Lorenzen and “two computer 
researchers” — Antonakakis and Dagon, who 
worked at Georgia Tech — “to search broadly 
through Internet data for any information about 
Trump's potential ties to Russia,” the indictment 
said. Durham said Joffe’s “goal” was to support 
an "inference" and "narrative" regarding Trump 
that would please certain “VIPs.” 


Research Projects Agency. 


A May 2016 press release from the school said 
“Georgia Tech researchers have been awarded a 
$2.9 million contract from the U.S. Defense 
Advanced Research Projects Agency to develop 
a cybersecurity method that will identify and 
defend against low-volume distributed denial of 
service attacks.” 


"DARPA is cooperating fully with the FBI and 
Department of Justice," Jared Adams, the chief 
of communications at DARPA, told the 
Washington Examiner. "Since this matter 
involves an ongoing criminal investigation, it 
would be inappropriate to comment further at 
this time." 


Joffe appears to have referred to himself as 
“Max” in a 2018 article by the New Yorker 
pushing the Alfa Bank claims. “Max” described 
himself as “a John McCain Republican.” 


Joffe has a lengthy history of working with the 
U.S. government. He was named to a third term 
on the FCC’s Communications, Security, 
Reliability, and Interoperability Council in 2015, 
and in 2013 he received the FBI Director’s Award 
for Outstanding Cyber Investigation “given his 
role in uncovering and dismantling the 
Butterfly Botnet.” 
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Tech executive-1 = Rodney Joffee, vp Neustar (NY Post) 


UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


UNITED STATES OF AMERICA 
CRIMINAL NO. 21-cr- 


Vv. 
MICHAEL A. SUSSMANN, : VIOLATIONS: 
: 18 U.S.C. § 1001(a)(2) 
Defendant. ; (Making a False Statement) 
INDICTMENT 
The Grand Jury charges that: 
A. Introduction and Overview 
kL In or about late October 2016 — approximately one week before the 2016 U.S. 


Presidential election — multiple media outlets reported that U.S. government authorities had 
received and were investigating allegations concerning a purported secret channel of 
communications between the Trump Organization, owned by Donald J. Trump, and a particular 
Russian bank (“Russian Bank-1”). 

2. According to one of these articles published by a major U.S. newspaper 
(“Newspaper-1”), intelligence officials possessed information concerning “what cyber experts said 
appeared to be a mysterious computer back channel between the Trump Organization and [Russian 
Bank-1].” The article further reported that the Federal Bureau of Investigation (“FBI”) had “spent 
weeks examining computer data showing an odd stream of activity to a Trump Organization 
server,” and that “[c]omputer logs obtained by [Newspaper-1]” showed “that two servers at 
[Russian Bank-1] sent more than 2,700 ‘look up’ messages... to a Trump-connected server 


beginning in the spring.” According to other articles, this information had been assembled by an 
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anonymous computer researcher who used the moniker ‘“Tea Leaves.” 

3: The FBI had, in fact, initiated an investigation of these allegations in response to a 
meeting that MICHAEL A. SUSSMANN, the defendant herein — a lawyer at a major international 
law firm (“Law Firm-1”) — requested and held with the FBI General Counsel on or about 
September 19, 2016 at FBI Headquarters in the District of Columbia. SUSSMANN provided to 
the FBI General Counsel three “white papers” along with data files allegedly containing evidence 
supporting the existence of this purported secret communications channel. 

4. During the meeting, SUSSMANN lied about the capacity in which he was 
providing the allegations to the FBI. Specifically, SUSSMANN stated falsely that he was not 
doing his work on the aforementioned allegations “for any client,” which led the FBI General 
Counsel to understand that SUSSMANN was acting as a good citizen merely passing along 
information, not as a paid advocate or political operative. In fact, and as alleged in further detail 
below, this statement was intentionally false and misleading because, in assembling and conveying 
these allegations, SUSSMANN acted on behalf of specific clients, namely, (i) a U.S. technology 
industry executive (“Tech Executive-1”) at a U.S. Internet company (“Internet Company-1”), and 
(ii) the Hillary Clinton Presidential Campaign (the “Clinton Campaign”). 

5, SUSSMANN’s lie was material because, among other reasons, SUSSMANN’s 
false statement misled the FBI General Counsel and other FBI personnel concerning the political 
nature of his work and deprived the FBI of information that might have permitted it more fully to 
assess and uncover the origins of the relevant data and technical analysis, including the identities 
and motivations of SUSSMANN’s clients. 


6. Had the FBI uncovered the origins of the relevant data and analysis, and as alleged 


i) 
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below, it might have learned, among other things, that (i) in compiling and analyzing the Russian 
Bank-1 allegations, Tech Executive-1 had exploited his access to non-public data at multiple 
Internet companies to conduct opposition research concerning Trump; (ii) in furtherance of these 
efforts, Tech Executive-1 had enlisted, and was continuing to enlist, the assistance of researchers 
at a U.S.-based university who were receiving and analyzing Internet data in connection with a 
pending federal government cybersecurity research contract; and (iii) SUSSMANN, Tech 
Executive-1, and Law Firm-1 had coordinated, and were continuing to coordinate, with 
representatives and agents of the Clinton Campaign with regard to the data and written materials 
that SUSSMANN gave to the FBI and the media. 

WV The FBI’s investigation of these allegations nevertheless concluded that there was 
insufficient evidence to support the allegations of a secret communications channel with Russian 
Bank-1. In particular, and among other things, the FBI’s investigation revealed that the email 
server at issue was not owned or operated by the Trump Organization but, rather, had been 
administered by a mass marketing email company that sent advertisements for Trump hotels and 
hundreds of other clients. 

B. The Defendant 

8. At all times relevant to this Indictment, SUSSMANN was employed at Law Firm- 
1. Previously, SUSSMANN was employed by the U.S. Department of Justice (‘DOJ’) in various 
capacities. In his work at the DOJ, SUSSMANN became familiar with U.S. criminal laws, 
including Title 18, United States Code, Section 1001, which criminalizes the making of materially 
false statements to U.S. officials. 


9. In his work at Law Firm-1, SUSSMANN represented numerous clients in 
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cybersecurity, privacy, and national security-related matters. In or about April 2016, the 
Democratic National Committee (“DNC”) retained SUSSMANN to represent it in connection with 
the hacking of its email servers by the Russian government. In connection with his representation 
of the DNC as the victim of a hack, the defendant met and communicated regularly with the FBI, 
the DOJ, and other U.S. government agencies. In or around the same time period, SUSSMANN 
was also advising the Clinton Campaign in connection with cybersecurity issues. 


C. Law Firm-1 and Its Role in the 2016 Presidential Election Campaign 


10. Law Firm-1 was at all times relevant to this Indictment an international law firm 
based in the United States. In or about April 2015, the Clinton Campaign retained Law Firm-1 as 
its counsel for the 2016 U.S. Presidential election. A law partner at Law Firm-1 (“Campaign 
Lawyer-1!") acted as the Clinton Campaign’s General Counsel. 

11. As part of its efforts to assist the Clinton Campaign and the DNC, Law Firm-1 
retained a particular investigative Firm (the “U.S. Investigative Firm”) to gather information 
regarding Trump’s purported ties to Russia. Throughout the Presidential campaign, the U.S. 
Investigative Firm worked with Law Firm-1, members of the media, and others to gather and 
disseminate purported evidence of Trump’s ties to Russia. 


D. Tech Executive-1 


12, Tech Executive-1 was at all times relevant to this Indictment an executive of a 
particular Internet company (“Internet Company-1”), which offers various Internet-related 


services and products, including Domain Name System (“DNS”) resolution services, to its 
customers. (DNS is a naming system for devices connected to the Internet that translates 


recognizable domain names, e.g., http://www.google.com, to numerical IP addresses, e.g., 
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123.456.7.89. A DNS “lookup” refers to an electronic request by a particular computer or device 
to query information from another device or server.) 

13. By virtue of his position at Internet Company-1 and other companies, Tech 
Executive-1 maintained direct or indirect access to, and the ability to provide others access to, 
large amounts of internet and cybersecurity data, including DNS data. 

14. In or about February 2015, Tech Executive-1 retained SUSSMANN as his lawyer 
in connection with a matter involving an agency of the U.S. government. SUSSMANN also 
frequently served as outside counsel to Internet Company-1, which was a significant source of 
revenue for Law Firm-1 and SUSSMANN. At all times relevant to this Indictment, Tech 
Executive-1 served as SUSSMANN’s primary point of contact at Internet Company-1. 

Is. In or about November 2016, Tech Executive-1 claimed to have been previously 
offered a position in the government in the event Hillary Clinton won the Presidency, stating in an 
email days after the U.S. Presidential election: “I was tentatively offered the top [cybersecurity] 
job by the Democrats when it looked like they’d win. I definitely would not take the job under 
Trump.” 


E. The Russian Bank Allegations 


16. By in or around late July 2016, the aforementioned computer researcher who used 
the moniker “Tea Leaves” (“Originator-1’) had assembled purported DNS data reflecting apparent 
DNS lookups between Russian Bank-1 and an email domain, “maill.trump-email.com” (the 
“Russian Bank Data’). The purported data spanned the time period from on or about May 4, 2016 
through on or about July 29, 2016. 


17. At all times relevant to this Indictment, Originator-1 was a business associate of 
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Tech Executive-1. By in or about July 2016, Tech Executive-] and others were in possession of 
the Russian Bank Data. 

18. Also, in or about July 2016, Tech Executive-1 alerted SUSSMANN to the Russian 
Bank Data. 

19. Over the ensuing weeks, and as part of their lawyer-client relationship, 
SUSSMANN and Tech Executive-1 engaged in efforts with Campaign Lawyer-1 and individuals 
acting on behalf of the Clinton Campaign to share information about the Russian Bank Data with 
the media and others, claiming that it demonstrated the existence of a secret communications 
channel between the Trump Organization and Russian Bank-1. 


SUSSMANN Bills the Clinton Campaign for His Communications with Tech Executive-1 and 
Campaign Lawyer-1 


20. From in or about late July through in or about mid-August 2016, SUSSMANN, 
Tech Executive-1, and Campaign Lawyer-1 coordinated and communicated about the Russian 
Bank-1 allegations during telephone calls and meetings, which SUSSMANN billed to the Clinton 
Campaign (denoted in Law Firm-1’s billing records by its official corporate name, “HFACC, 
ine,” ); 

a. For example, on or about July 29, 2016, SUSSMANN and Campaign Lawyer-1 
met with personnel from the U.S. Investigative Firm in Campaign Lawyer-1l’s office. 
SUSSMANN billed his time in this meeting to the Clinton Campaign under the category “General 
Political Advice” with the billing description “meeting with [Campaign Lawyer-1], others 
regarding [] confidential project.” (For all of SUSSMANN’s other billing entries cited herein that 
he billed to the Clinton Campaign, he similarly billed his time to the campaign under the category 


“General Political Advice’’). 
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b. On or about July 31, 2016, SUSSMANN billed the Clinton Campaign for twenty- 
four minutes with the billing description, “communications with [Campaign Lawyer-1] regarding 
server issue.” 

c. On or about August 12, 2016, SUSSMANN, Campaign Lawyer-1, and Tech 
Executive-1 met in Campaign Lawyer-1’s office. In connection with this meeting, SUSSMANN 
billed his time to the Clinton Campaign with the billing description “confidential meetings with 
[Campaign Lawyer-1], others.” 

d. In or around the same time period, SUSSMANN, Campaign Lawyer-1, and 
personnel from the U.S. Investigative Firm began exchanging emails with the subject line, 
“Connecting you all by email.” 

e. On or about August 17, 2016, SUSSMANN, Campaign Lawyer-1, and Tech 
Executive-1 conducted an additional conference call. SUSSMANN billed this time to the Clinton 
Campaign with the billing descriptions “telephone conference with [Tech Executive-1], 
{Campaign Lawyer-1].” 

f. Onor about August 19,2016, SUSSMANN and Campaign Lawyer-1 conducted an 
additional in-person meeting that appeared in SUSSMANN’s calendar as “Meeting with [Tech 
Executive-1’s first name].””> SUSSMANN billed this time to the Clinton Campaign within the 
billing description stating, in part, “confidential meeting with [Campaign Lawyer-1], others[.]” 

g. Later in or about August 2016, Tech Executive-1 exchanged emails with personnel 


from the U.S. Investigative Firm. 


Tech Executive-1 Uses His Access at Multiple Internet Companies to Conduct Opposition 
Research and Create a “Narrative” Regarding Trump 


Bil As alleged in further detail below, in or around the same time period — and in 


7 
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furtherance of his efforts with SUSSMANN and Campaign Lawyer-1 to disseminate allegations 
regarding Trump — Tech Executive-1 used his access at multiple organizations to gather and mine 
public and non-public Internet data regarding Trump and his associates, with the goal of creating 
a “narrative” regarding the candidate’s ties to Russia. 

a, Tech Executive-1 later shared certain results of these data searches and analysis 


with SUSSMANN so that SUSSMANN, in turn, could provide them to the media and the FBI. 


Tech Executive-1 Obtains Internet Data Relating to Trump from Internet Company-2 


a. For example, in or about early August 2016 — the same time period of his 
aforementioned communications with SUSSMANN and Campaign Lawyer-1 — Tech Executive- 
1 directed and caused employees of two companies in which he had an ownership interest 
(“Internet Company-2” and “Internet Company-3”) to search and analyze their holdings of public 
and non-public internet data for derogatory information on Trump. 

b. At all times relevant to this Indictment, Internet Company-2 was a company that, 
among other things, collected DNS data from various points on the Internet. 

c. Atall times relevant to this Indictment, Internet Company-3 was owned by the same 
company as Internet Company-2. As part of its business, Internet Company-3 received data that 
had been collected by Internet Company-2 or its parent company, and then used and analyzed that 
data in order to advise its private sector customers on cybersecurity and business risks. 

d. In or about early August 2016, Tech Executive-1 called an individual at Internet 
Company-3. During the call, Tech Executive-1 instructed the individual to task Internet 
Company-3 employees to search for any Internet data reflecting potential connections or 


communications between Trump or his associates and Russia. 
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e. In connection with this tasking, Tech Executive-1 Jater stated that he was working 
with someone who had close ties to the Democratic Party and to Hillary Clinton. 

f. The aforementioned individual and other personnel at Internet Company-3 were 
uncomfortable regarding this tasking from Tech Executive-1 because they believed that using the 
companies’ data in this manner was inappropriate. They complied with the tasking, however, 
because Tech Executive-1 was a powerful figure at both companies. 

g. In connection with this tasking, Tech Executive-1 emailed to Internet Company-3 
personnel a five-page document (the “Trump Associates List”) listing six associates of Trump and 
a purported U.S.-based lobbyist for Russian Bank-1 who was also discussed in written materials 
prepared by the U.S. Investigative Firm that SUSSMANN would later provide to the FBI General 
Counsel. The Trump Associates List contained detailed personal information for these 
individuals, including, for example, their names, home addresses, personal email addresses, 
business names, business websites and email domains, suspected IP addresses for those domains, 
and information pertaining to the spouse of one of these associates. Tech Executive-1 directed 
that these individuals should be a focus of Internet Company-3’s data queries and analysis. 

h. On or about August 15, 2016, employees of Internet Company-2, acting at the 
request of Internet Company-3, queried their holdings of non-public Internet data against a lengthy 
list of more than 9,000 IP addresses, 3,000 internet domains, and 60 email addresses and domains 
that related or referred to Trump, the Trump Organization, the aforementioned Trump associates, 
and/or Russian Bank-1 (i.e., the bank that was the subject of the allegations that SUSSMANN later 
conveyed to the FBI General Counsel). 


i. During the same time period, employees of Internet Company-3 also drafted and 
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provided to Tech Executive-1 a written paper reflecting, in substance, some of the same technical 
observations contained in the Russian Bank-1 allegations that SUSSMANN later conveyed to the 
FBI. 


Tech Executive-1 Tasks Originator-1 and University Researchers to Search for Internet Data 
Regarding Trump 


23% Also in or around the same time period, and in connection with Tech Executive-1’s 
joint efforts with SUSSMANN, Tech Executive-1 similarly tasked Originator-1 and two computer 
researchers (‘“Researcher-1” and “Researcher-2”) who worked at a U.S.-based university 
(‘“University-1”) to search broadly through Internet data for any information about Trump’s 
potential ties to Russia. In connection with this tasking, and as alleged in further detail below, 
Tech Executive-1’s goal was to support an “inference” and “narrative” regarding Trump that 
would please certain “VIPs.” Moreover, and as alleged below, Tech Executive-1 provided 
information that he gathered through these interactions to his lawyer, SUSSMANN, so that 
SUSSMANN could assist in drafting and disseminating materials to the media and the FBI. 

Background on the Agency-I Contract 

a. At the time of these exchanges in or about August 2016, a federal government 
agency (“Agency-1”) was in the process of finalizing, but had not yet signed, a cybersecurity 
research contract with University-1 (the “Agency-1 Contract”). The primary purpose of the 
Agency-1 Contract was for University-1 researchers to receive and analyze large quantities of 
public and non-public data (including DNS data) from various Internet companies in order to 
identify the perpetrators of malicious cyber-attacks and protect U.S. national security. 

b. Originator-1 was not a participant in the contract but was the founder of a company 


that University-1 researchers were considering as a potential data provider under the contract. 


10 
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c. Tech Executive-1 and his employer, Internet Company-1, would ultimately sell 
large amounts of historical and ongoing DNS data to University-1 for use and analysis under the 
Agency-1 Contract. 

d. Although the Agency-1 Contract was not signed until in or around November 
2016, Internet Company-1 — through Tech Executive-1 — provided University-1 with early access 
to its Internet data in order to establish a “proof of concept” for work under the contract. Among 
the data that University-1 accessed through Internet Company-1 was the DNS data of an Executive 
Branch office of the U.S. government (“Office-1”), which Internet Company-1 had come to 
possess as a sub-contractor in a sensitive relationship between the U.S. government and another 
company. 

e. The purpose of providing Internet Company-1’s data to University-1 during this 
time period was to enable researchers who worked under the Agency-1 Contract to protect U.S. 
networks from cyberattacks. From in or about July 2016 through at least in or about February 
2017, however, Originator-1, Researcher-1, and Researcher-2 also exploited Internet Company- 
1’s data and other data to assist Tech Executive-1 in his efforts to conduct research concerning 
Trump’s potential ties to Russia, including the Russian Bank-1 allegations that SUSSMANN 
would later convey to the FBI. 

Research Concerning Trump 
f. For example, on or about July 29, 2016, Researcher-2 emailed to Researcher-1 the 
Russian Bank Data compiled by Originator-1. 
g. On or about August 19, 2016, Researcher-1 queried internet data maintained by 


Internet Company-1 for the aforementioned mail1.trump-email.com domain that was the subject 
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of the allegations SUSSMANN would later convey to the FBI. Researcher-1 then emailed Tech 
Executive-1 and others a list of domains that had communicated with it — none of which appeared 
to have links to Russia. Researcher-1 noted that the list “does not make much sense with the 
storyline you have,” referring to the storyline connecting Trump to Russia. 

h. On or about August 20, 2016, Originator-1 emailed Tech Executive-1, Researcher- 
1, and Researcher-2, stating, among other things, that “even if we found what [Tech Executive-1] 
asks us to find in DNS, we don’t see the money flow, and we don’t see the content of some message 
saying ‘send the money here’.” Originator-1 then explained that it would be possible to “fill out 
a sales form on two websites, faking the other company’s email address in each form,” and thereby 
cause them “to appear to communicate with each other in DNS.” Originator-1 then concluded: 
“I[f] [Tech Executive-1] can take the *inference* we gain through this team exercise . . . then work 
to develop even an inference may be worthwhile. . . .It’s just not the case that you can rest assured 
that Hillary’s opposition research and whatever professional gov[ernments] and investigative 
journalists are also digging [will] come up with the same things[.]” (asterisks in original). 

i. On or about the same date, Tech Executive-1 clarified in an email to Originator-1, 
Researcher-1, and Researcher-2 that the “task” he had given them was “indeed broad” and further 
stated, in part: 

Being able to provide evidence of *anything* that shows an attempt 

to behave badly in relation to this, the VIPs would be happy. They’ re 

looking for a true story that could be used as the basis for closer 

examination. 

(emphasis added; asterisks in original). Regarding the Russian Bank-1 allegations that he had 


provided to SUSSMANN, Tech Executive-1’s email stated: “[T]he prior hypothesis was all that 


they needed: [a] mailserver dedicated or related to [T]rump . . . and with traffic almost exclusively 
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with [Russian Bank-1] was sufficient to do the job.” Tech Executive-! continued, “Trump has 
claimed he and his companf[ies] have had NO dealings with .ru other than the failed Casino, and 
the Miss universe pageant. He claims absolutely NO interaction with any financial institutions. 
So any potential like that would be jackpot.” 

j. Onor about August 21, 2016, Tech Executive-1 emailed the recipients, urging them 
to push forward with additional research concerning Trump, which he stated would “give the base 
of a very useful narrative.” Later in the same email, Tech Executive-1 expressed his own belief 
that the “trump-email.com” domain (referring to the subject of the allegations that SUSSMANN 
conveyed to the FBI) was not a secret communications channel with Russian Bank-1, but “a red 
herring,” noting that the host for that domain “is a legitimate valid [customer relationship 
management] company.” Tech Executive-1 therefore concluded that “we can ignore it, together 
with others that seem to be part of the marketing world.” 

k. On or about August 22, 2016, Researcher-1 emailed the aforementioned recipients, 
expressing continued doubt regarding the Russian Bank-1 allegations that SUSSMANN would 
later convey to the FBI, and raising concerns about the researchers’ bias against Trump: 

Let|’]s for a moment think of the best case scenario, where we are able 

to show (somehow) that DNS [] communication exists between Trump 

and R[ussia]. How do we plan to defend against the criticism that 

this is not spoofed |] traffic we are observing? There is no answer to 

that. Let’s assume again that they are not smart enough to refute our 

“best case” scenario. [Tech Executive-1], you do realize that we will 

have to expose every trick we have in our bag to even make a very 

weak association? Let[‘]s all reflect upon that for a moment. Sorry 

folks, but unless we get combine netflow and DNS traffic collected at 


critical points between suspect organizations, we cannot technically 
make any claims that would fly public scrutiny. 
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The only thing that drive|s] us at this point is that we just do not 
like [Trump]. This will not fly in eyes of public scrutiny. Folks, I 
am afraid we have tunnel vision. Time to regroup? 


(emphasis added). 


SUSSMANN and His Client Prepare a White Paper Summarizing the Russian Bank-1 
Allegations 


24. Despite the aforementioned views that the Russian Bank Data and allegations were 
a “red herring” that should be “ignored,” SUSSMANN, Tech Executive-1, Originator-1, and the 
University-1 researchers began to draft, review, and revise a “white paper” summarizing the 
Russian Bank-! allegations that SUSSMANN would later provide to the FBI. SUSSMANN 
continued to bill time on these matters to the Clinton Campaign. 

a. For example, on or about September 5, 2016, SUSSMANN began billing work for 
the drafting of the aforementioned white paper. SUSSMANN billed this work to the Clinton 
Campaign with a billing description that read, in part, “work on white paper; follow-up telephone 
conferences and email.” (emphasis added). 

b. On or about September 6, 2016, SUSSMANN continued to work on the white 
paper. On or about the same date, SUSSMANN also met with representatives of the U.S. 
Investigative Firm and communicated with the media. SUSSMANN billed this work to the 
Clinton Campaign with the billing description, “Meeting with consultant [and Campaign Lawyer- 
1]; revisions to white paper, meeting with expert; meeting with expert and reporter; follow- 
up meeting with reporter; conversations with [Campaign Lawyer-1].” (emphasis added). 

c. On or about September 7, 2016, SUSSMANN continued work on the white paper. 
SUSSMANN billed his time for that work to the Clinton Campaign with the billing description, 


“Meetings and other communications regarding confidential project; work on written materials.” 
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(emphasis added). 

d. On or about September 14, 2016 — five days before his meeting with the FBI 
General Counsel - SUSSMANN continued work on the white paper. SUSSMANN also met with 
Tech Executive-1 in SUSSMANN’s office. On or about the same date, SUSSMANN billed time 
to the Clinton Campaign with the billing description “Multiple meetings regarding confidential 
project, draft white paper [],” and to Internet Company-1 with the billing description, 
“communications regarding confidential project.” (emphasis added). 

e. On or about the same day — and just five days before SUSSMANN conveyed the 
aforementioned allegations to the FBI — Tech Executive-1 sent the white paper that SUSSMANN 
had been working on to Originator-1, Researcher-1, and Researcher-2. In an email, Tech 
Executive-1 sought their views as to whether the paper’s allegations would be “plausible” to 
“security experts,” even if the allegations were not demonstrably true: 

Please read as if you had no prior knowledge or involvement, and 
you were handed this document as a security expert (NOT a dns 
expert) and were asked: ‘Is this plausible as an explanation?’ NOT 
to be able to say that this is, without doubt, fact, but to merely 
be plausible. Do NOT spend more than a short while on this (If 


you spend more than an hour you have failed the assignment). 
Hopefully less. :) 


(emphasis added). 

f. On or about the same date, Researcher-1! replied, stating that the white paper 
achieved Tech Executive-1’s objective, but noting that the paper “smartly” avoided discussing 
weaknesses or “holes” in the paper’s hypothesis: 

A DNS expert would poke several holes to this hypothesis 
(primarily around visibility, about which very smartly you do not 


talk about). That being said, | do not think even the top security 
(non-DNS) researchers can refute your statements. Nice! 
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(emphasis added). 

g. On or about September 15, 2016, Originator-1 responded to Tech Executive-1, 
stating, in part, that the paper’s conclusion was “plausible” in the “narrow scope” defined by Tech 
Executive-1. 

h. On or about the same date, Reseacher-2 replied, acknowledging that questions 
remained, but stating, in substance and in part, that the paper should be shared with government 
officials. 

i. On or about September 16, 2016, Originator-1 replied to the aforementioned 
recipients, discussing an allegation that SUSSMANN would soon convey to the FBI regarding 
Russian Bank-1’s alleged use of a purported “TOR exit node” (i.e., a node used for anonymized 
internet traffic) at a particular U.S.-based healthcare company (“Healthcare Company-1”) to 
communicate with the Trump Organization. Originator-1’s email stated, in part, “{Tech 
Executive-1] has carefully crafted a message that could work to accomplish the goals.” 


SUSSMANN Shares the Russian Bank-1 Allegations with the Media 


2); In or around the same time period, SUSSMANN, acting on behalf of Tech 
Executive-! and the Clinton Campaign, disseminated the Russian Bank-1 allegations to the media. 
SUSSMANN billed this time to the Clinton Campaign. 

a. For example, on about August 30, 2016, Reporter-1 — who would later author the 
above-referenced October 31, 2016 article about the Russian Bank-1 allegations — emailed 
SUSSMANN: “I’m back in town. I see Russians are hacking away. [A]ny big news?” 

b. SUSSMANN replied on the same date: “Mind reader! .. . Can you meet Thurs and 
Fri?” 
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c. On or about September 1, 2016, SUSSMANN met with Reporter-1. SUSSMANN 
billed his time for the meeting to the Clinton Campaign under the broader billing description 
“confidential meetings regarding confidential project.” 

d. On or about September 12, 2016, SUSSMANN spoke with Campaign Lawyer-] 
via phone regarding SUSSMANN’s efforts to communicate with Newspaper-1 regarding the 
Russian Bank-1 allegations. SUSSMANN and Campaign Lawyer-| each billed the call to the 
Clinton Campaign with Campaign Lawyer-1 using the billing description “teleconference with M. 
Sussmann re: [Newspaper-1],” and SUSSMANN using the description “work regarding 
confidential project.” 

e. On or about September 15, 2016, Campaign Lawyer-1 exchanged emails with the 
Clinton Campaign’s campaign manager, communications director, and foreign policy advisor 
concerning the Russian Bank-1 allegations that SUSSMANN had recently shared with Reporter- 
1. Campaign Lawyer-1 billed his time for this correspondence to the Clinton Campaign with the 
billing entry, “email correspondence with [name of foreign policy advisor], [name of campaign 


manager], [name of communications director] re: [Russian Bank-1] Article.” (emphasis added). 


SUSSMANN Prepares for His Meeting with the FBI 


26. From on or about September 17 through on or about September 18, 2016 —ie., the 
weekend before SUSSMANN’s Monday meeting with the FBI General Counsel - SUSSMANN 
continued to work on disseminating the Russian Bank-1 allegations on behalf of Tech Executive- 
1 and the Clinton Campaign, and continued to bill his work to the campaign. 

a. For example, on or about September 17, 2016, SUSSMANN spoke on the phone 


with Researcher-2. During the phone call, SUSSMANN, among other things, requested that 
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Researcher-2 speak on background with members of the media regarding the Russian Bank-1 
allegations, which Researcher-2 did over the course of the following weeks. 

b. On or about the same date, SUSSMANN sent to Researcher-2 an electronic file 
containing materials he would provide two days later to the FBI General Counsel, including, 
among other things, the aforementioned white paper that SUSSMANN had assisted in drafting, 
and another white paper drafted by the U.S. Investigative Firm concerning purported ties between 
Russian Bank-1’s parent company and the Russian government. 

c. SUSSMANN billed all of the aforementioned work on or about September 17, 2016 
to the Clinton Campaign with the billing description “Multiple telephone conferences and other 
communications with experts, media; communications with [Campaign Lawyer-1].” (emphasis 
added). 

d. On or about the next day — Sunday, September 18, 2016 - SUSSMANN continued 
to work on the Russian Bank-1 allegations, and to prepare for his meeting with the FBI. 
SUSSMANN billed this time to the Clinton Campaign with the billing description “Further 
communications and work regarding confidential project.” 


SUSSMANN’s False Statement to the FBI General Counsel 


21. On or about September 19, 2016, SUSSMANN met with the FBI General Counsel 
at FBI Headquarters in the District of Columbia to convey the Russian Bank-1 allegations. No 
one else attended the meeting. During the meeting, the following, in substance and in part, 
occurred: 

a. SUSSMANN stated falsely that he was not acting on behalf of any client, which 


led the FBI General Counsel to understand that SUSSMANN was conveying the allegations as a 
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good citizen and not as an advocate for any client; 

b. SUSSMANN stated that he had been approached by multiple cyber experts 
concerning the Russian Bank-1 allegations; 

c. SUSSMANN provided the names of three cyber experts, but did not name or 
mention Tech Executive-1, the Clinton Campaign, or any other person or company referenced 
above; 

d. SUSSMANN described the allegations of a secret Trump Organization server that 
was in communication with Russian Bank-1, including that Russian Bank-1 had used a TOR exit 
node located at Healthcare Company-1 to communicate with the Trump Organization; 

e. SUSSMANN stated that media outlets were in possession of information about the 
Trump Organization’s secret server, and that a story would be published on Friday of that week; 

f. SUSSMANN provided to the FBI General Counsel two thumb drives and hard copy 
papers, which contained and were comprised of the following: 

i. the aforementioned white paper that SUSSMANN had assisted in drafting, 
entitled White Paper #1 Auditable V3, which contained no date or author’s name; 
ii. a white paper drafted by Researcher-2, which was entitled, White Paper 
Comments: Time Series Analysis of Recursive Queries, dated September 19, 2016, and contained 
no author’s name; 
ii. the aforementioned white paper drafted by the U.S. Investigative Firm 
regarding Russian Bank-1 and its parent company, which contained no date or author’s name; and 
iv. eight files containing the Russian Bank Data and other purported data and 


information relating to the mail! .trump-emai!.com domain. 
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28. Immediately after the aforementioned September 19, 2016 meeting, the FBI 
General Counsel spoke with the Assistant Director of the FBJ’s Counterintelligence Division. 
During their conversation, the FBI General Counsel conveyed the substance of his meeting with 
SUSSMANN. The Assistant Director took contemporaneous handwritten notes which reflect, in 
substance, the above-referenced statements by SUSSMANN and state, in relevant part: 


Michael Sussman[n] — Atty: [Law Firm-1] — said not doing this for any client 
e Represents DNC, Clinton Foundation, etc. 


° i approached by Prominent Cyber People (Academic or Corp. POCs) 
People like: [three names redacted] 

(emphasis added) 

Zo SUSSMANN billed his meeting with the FBI General Counsel to the Clinton 
Campaign with the billing description, “work and communications regarding confidential project.” 

30. - SUSSMANN’s statement to the FBI General Counsel that he was not acting on 
behalf of any client was knowingly and intentionally false. In truth and in fact, and as 
SUSSMANN well knew, SUSSMANN acted on behalf of and in coordination with two specific 
clients of Law Firm-1, i.e., Tech Executive-1 and the Clinton Campaign, in assembling and 
conveying these allegations. In particular, and as also alleged above, Tech Executive-1 consulted 
and relied on SUSSMANN as his lawyer to assist in disseminating the Russian Bank-! allegations. 
Moreover, all or nearly all of SUSSMANN’s recorded time and work relating to the Russian Bank- 
1 allegations prior to the meeting with the FBI (including communications with the media) were 
billed to the Clinton Campaign. Indeed, and as SUSSMANN concealed and failed to disclose, (i) 


SUSSMANN had spent time drafting one of the white papers he provided to the FBI General 


Counsel and billed that time to the Clinton Campaign, and (ii) the U.S. Investigative Firm — which 
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at the time was also acting as a paid agent of the Clinton Campaign — had drafted another of those 
white papers. 

31, In addition, and as alleged in further detail below, SUSSMANN testified under oath 
before Congress in 2017 that he, in fact, conveyed the Russian Bank-1 allegations to the FBI 
General Counsel “on behalf of my client.” See Paragraph 44, infra. 

32. In the days following SUSSMANN’s meeting with the FB] General Counsel, and 
as a result of that meeting, the FBI opened an investigation of the Russian Bank-1 allegations. 
SUSSMANN’s false statement to the FBI General Counsel was material to that investigation 
because, among other reasons, it was relevant to the FBI whether the conveyor of these allegations 
(SUSSMANN) was providing them as an ordinary citizen merely passing along information, or 
whether he was instead doing so as a paid advocate for clients with a political or business agenda. 
Had SUSSMANN truthfully disclosed that he was representing specific clients, it might have 
prompted the FBI General Counsel to ask SUSSMANN for the identity of such clients, which, in 
turn, might have prompted further questions. In addition, absent SUSSMANN’s false statement, 
the FBI might have taken additional or more incremental steps before opening and/or closing an 
investigation. The FBI also might have allocated its resources differently, or more efficiently, 
and uncovered more complete information about the reliability and provenance of the purported 
data at issue. 


SUSSMANN Continues to Communicate with the Media on Behalf of His Clients 


33. Further demonstrating that SUSSMANN carried out the aforementioned work on 
behalf of his clients, SUSSMANN continued in the weeks following this meeting to coordinate 


with Tech Executive-1, Campaign Lawyer-1, and the U.S. Investigative Firm to disseminate the 
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Russian Bank-1 allegations to the media. SUSSMANN continued to bill his time for such work 
to the Clinton Campaign. 

34, For example, on or about October 10, 2016, SUSSMANN emailed Reporter-1 a 
link to an opinion article which asserted, in substance and in part, that Newpaper-1’s investigative 
reporters had not published as many stories regarding Trump as other media outlets. The subject 
line of SUSSMANN’s email was “for your editors,” and the body stated, “You should send this 
link to them.” At or around that time, and according to public sources, Reporter-1 was working 
on an article concerning the Russian Bank-1 allegations, but Reporter-1’s editors at Newspaper-1 
had not yet authorized publication of the article. 

a3: On or about October 30, 2016, an employee of the U.S. Investigative Firm (the 
“Investigative Firm Employee”) forwarded another reporter (“Reporter-2”) a tweet, which 
indicated that the FBI Director had “explosive information about Trump’s ties to Russia.” The 
Investigative Firm Employee’s email stated, “time to hurry,” suggesting that Reporter-2 should 
hurry to publish an article regarding the Russian Bank-1 allegations. In response, Reporter-2 
emailed to the Investigative Firm Employee a draft article regarding the Russian Bank-1 
allegations, along with the cover message: “Here’s the first 2500 words.” 

36. On or about the following day, October 31, 2016, both Reporter-1 and Reporter-2 
published articles regarding the Russian Bank-1 allegations. 

ae. On or about the same date, SUSSMANN continued to communicate with several 
reporters about the media coverage, billing these communications to the Clinton Campaign with 
the billing description, “Communications regarding [Reporter-2’s employer] story, [Newspaper- 


1] reporting; communications with [another news outlet].” 
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38. Soon after the 2016 U.S. Presidential election, the Clinton Campaign ceased to 
exist, and SUSSMANN stopped billing his recorded time on these matters to the Clinton 
Campaign. In the ensuing months, SUSSMANN billed some of his time on the Russian Bank-1 
allegations and related matters to Tech Executive-1. 


SUSSMANN Repeats His False Statement to Another Government Agency 


39, In or about late 2016 and early 2017, Tech Executive-1, Originator-1, and 
Researcher-2 continued to compile additional information and data regarding the Russian Bank-1 
allegations, and gathered other purported data allegedly involving Trump-related computer 
networks and Russia (collectively, the “Updated Allegations”). SUSSMANN would later convey 
these allegations to another U.S. government agency (“Agency-2”). In doing so, and as alleged 
below, SUSSMANN repeated, in substance, the same false statement he had made to the FBI 
General Counsel that he was not acting on behalf of a client. 

SUSSMANN Seeks a Meeting with Agency-2 

40. In or about late December 2016, SUSSMANN contacted the General Counsel of 
Agency-2 to set up a meeting regarding the Updated Allegations, but the meeting did not go 
forward. 

41. Approximately one month later, SUSSMANN contacted a former employee of 
Agency-2 (the “Former Employee”) in a further attempt to obtain a meeting at Agency-2. The 
Former Employee communicated with SUSSMANN on or about January 31, 2017, during which 
the following, in substance and in part, occurred: 

a. Contrary to his prior false representation to the FBI General Counsel and a 


representation he would subsequently make to Agency-2 (see below), SUSSMANN advised the 
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Former Employee that he represented a “client.” 

b. SUSSMANN summarized the Updated Allegations. 

c. SUSSMANN requested that the Former Employee assist him in obtaining a 
meeting with Agency-2 and stated that if Agency-2 was not interested, SUSSMANN’s client 
would likely go to Newspaper-1 with the allegations. 

SUSSMANN Repeats His False Statement to Agency-2 
42. On or about February 9, 2017, SUSSMANN met with two Agency-2 employees 
(“Employee-1” and “Employee-2”) at a location outside the District of Columbia. At the meeting, 
the following, in substance and in part, occurred: 

a. SUSSMANN stated falsely — as he previously had stated to the FB] General 
Counsel — that he was “not representing a particular client.” In truth and in fact, and as 
SUSSMAN had acknowledged to the Former Employee just days earlier, SUSSMANN was 
representing a client. 

b. SUSSMANN disclosed that Law Firm-1 was active in representing several 
Democratic Party causes and officer-holders, including both the DNC and Hillary Clinton. 
SUSSMANN stated, however, that such work was unrelated to his reasons for contacting Agency- 
2. 

c. SUSSMANN discussed and described the Updated Allegations, including new 
details concerning the Russian Bank-1 allegations that he had not provided to the FBI General 
Counsel. 

d. SUSSMANN provided to the Agency-2 Employees (i) several white papers, and 


(ii) multiple data files containing purported DNS data, ranging from 2016 through early 2017. 
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43. After the meeting with SUSSMANN, Employee-1 and Employee-2 drafted and 
revised a Memorandum for the Record that reflected the above-described statements by 
SUSSMANN. 


SUSSMANN Contradicts His False Statements in Testimony Before Congress 


44. In or about December 2017, SUSSMANN testified under penalty of perjury before 
staffers of the House Permanent Select Committee on Intelligence, which was investigating 
Russian interference and other matters relating to the 2016 Presidential election. During his 
testimony, SUSSMANN directly contradicted his false statements to the FBI and Agency-2 that 
he was not acting on behalf of any client: 

Q: [] When you decided to engage the two principals, one, [the FBI 

General Counsel] in September, and the general counsel of 


[Agency-2] in December, you were doing that on your own 
volition, based on information another client provided you. Is that 


correct? 

A: No. 

Q: So what was -- so did your client direct you to have those 
conversations? 

A: Yes. 


Q: Okay. And your client also was witting of you going to [redacted] 
in February to disclose the information that individual had provided 


you? 
A: Yes 
[...] 
Q: Okay. I want to ask you, so you mentioned that your client directed 


you to have these engagements with the FBI and [redacted] and to 
disseminate the information that client provided you. Is that correct? 
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A: Well, I apologize for the double negative. It isn’t not correct, but 
when you say my client directed me, we had a conversation, as 
lawyers do with their clients, about client needs and objectives and 
the best course to take for a client. And so it may have been a 
decision that we came to together. I mean, I don't want to imply that 
I was sort of directed to do something against my better judgment, 
or that we were in any sort of conflict, but this was -- I think it's 
most accurate to say it was done on behalf of my client. 


(emphasis added). 
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COUNT ONE 

45. Paragraphs 1 to 44 are incorporated by reference. 

46. On or about September 19, 2016, within the District of Columbia, MICHAEL A. 
SUSSMANN, the defendant, did willfully and knowingly make a materially false, fictitious, and 
fraudulent statement or representation in a matter before the jurisdiction of the executive branch 
of the Government of the United States, to wit, on or about September 19, 2016, the defendant 
stated to the General Counsel of the FBI that he was not acting on behalf of any client in conveying 
particular allegations concerning a Presidential candidate, when in truth, and in fact, and as the 
defendant well knew, he was acting on behalf of specific clients, namely, Tech Executive-1 and 
the Clinton Campaign. 


(In violation of Title 18, United States Code, Section 1001(a)(2)) 


-‘S. Department of Justice 


A TRUE BILL: 


Foreperson 
Date: September 16, 2021 


af 


Ol emptywheel 


JOHN DURHAM ADMITS HE 
OVERSTATED EVIDENCE IN HIS 
MICHAEL SUSSMANN MATERIALITY 
STATEMENT 


JOHN DURHAM ADMITS HE OVERSTATED 
EVIDENCE IN HIS MICHAEL SUSSMANN 
MATERIALITY STATEMENT 

October 21, 2021 / 42 Comments / in 2016 Presidential 


Election, Mueller Probe / by emptywheel 


In my post 
[https://www.emptywheel.net/2021/10/07/michael- 
sussmann-attempts-to-bill-of-particulars-durham- 


for-his-sloppy-indictment-language/] laying out 


Michael Sussmann’s motion for a Bill of Particulars 


[https://www.documentcloud.org/documents/21079839- 


211006-motion-for-bill-of-particulars] , | expressed 


the following: 


e His claim that he needed the exact quote of the 


lie he purported told Jim Baker was well-founded 


Fey emptywheel 


people at a CIA meeting where, Durham alleges, 
just two people present now claim that 


Sussmann lied about having a client 


e Sussmann surely knew there were no people on 
the Clinton Campaign with whom he had — as 
Durham had insinuated in a materiality 
statement — [personally] coordinated; he knew 
any such communications happened through 


Marc Elias 


As | tweeted out 
[https://twitter.com/emptywheel/status/1450942118336376! 
here, Durham’s response 
[https://www.documentcloud.org/documents/21089372- 
211020-sussmann-govt-opposition-bill-of- 

particulars] to Sussmann affirms all of those 

predictions. 


e Durham responded to the request for the exact 
quote of the lie Sussmann purportedly told by 
block-quoting the indictment (which doesn’t 
quote his lie), but not providing the actual lie he 
told or the context in which he allegedly told it; in 
the process, Durham seemed to commit that he 
was not charging Sussmann with a lie of omission 
but only alleging Sussmann omitted material 


information with an alleged affirmative lie 


e Durham quoted the traditional definition of 
materiality (not the one DOJ espoused with Mike 


Flynn), and said it was up to the jury to decide 


0. emptywheel 


he allegedly did to the FBI) 


But it’s Durham’s response to the request for the 
names of the Clinton Campaign people with whom 
Sussmann allegedly coordinated that | find most 
telling. Sussmann had asked for the identity of the 
Clinton Campaign people that Durham mentioned in 
a passage (bolded below) from paragraph 6 of the 
indictment 


[https://www.documentcloud.org/documents/21080001- 


210916-sussmann- 


indictment#document/p3/a2058998] that Durham 


used as one of three prongs in his materiality 


statement. 


Finally, Mr. Sussmann seeks the 
identities of certain representatives 
and agents of the Clinton Campaign 
mentioned in the Indictment that the 
Special Counsel has refused to provide 
to date.7 The Indictment alleges that 
Mr. Sussmann, Tech Executive-1, and 
Law Firm-1 “coordinated, and were 
continuing to coordinate, with 
representatives and agents of the 
Clinton Campaign with regard to the 
data and written materials that 
Sussmann gave to the FBI and the 
media.” Indictment 4 6. The 
Indictment does not identify by name 
the alleged “representatives and 
agents of the Clinton Campaign.” Id. 


Fey emptywheel 


- ’ 


he was not acting on behalf of any 
client in order to conceal his ties to the 
campaign. The Special Counsel should 
not be permitted, on the one hand, to 
allege that Mr. Sussmann was working 
on behalf of the Clinton Campaign, 
but on the other hand, decline to 
identify the specific individuals with 
whom he was purportedly working. 
Among other things, Mr. Sussmann 
may wish to call such individuals as 
witnesses in his defense at trial, but, 
unless he knows of their identities, he 
will have no ability to do so. At base, 
an indictment must provide a 
defendant with the “essential facts 
constituting the offense charged.” Fed 
R. Crim. P. 7(c)(1). And no facts could 
be more essential than the names of 
the witnesses involved. 


Having made these allegations, the 
Special Counsel must illuminate them 
—by identifying the relevant 
individuals referenced—to allow Mr. 
Sussmann to decide how to respond 
appropriately. See Butler, 822 F.2d at 
1193 (the indictment must enable the 
defendant to understand the charges 
against him and prepare a defense); cf. 
Hubbard, 474 F. Supp. at 80 (ordering 
bill of particulars to define 
“unnecessarily vague” phrases used in 
the indictment). Therefore, Mr. 
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respect to Paragraph 6. 


7 The Special Counsel has identified 
virtually all of the other anonymous 
individuals and entities referred to in 
the Indictment (except, as noted 
above, the Agency-2 employees). 


In my post, | suggested that Sussmann isn’t so much 
trying to get these names, but because he knows this 
claim is false, he’s trying to get Durham to admit that 
there are no names — because (Sussmann knows) he 
didn’t coordinate directly with the Clinton 


Campaign. 


Sussmann likely doesn’t 

really need these names because he 
likely knows that Durham has nothing 
to substantiate this claim. If he did, 
Durham would have described such 
evidence in his speaking indictment. 


And Durham’s response cedes the point: In response 
to a question about the “agents and representatives 
of the Clinton Campaign” with whom Sussmann 
directly coordinated referenced in paragraph 6, 
Durham explains that that reference is just a 
“summary” of “facts” later alleged in paragraphs 
25(e), 20(d), and 20(g). 
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the later parts of the Indictment 
provide details underlying the more 
generalized allegation in Paragraph 6. 
For example, Paragraph 25(e) of the 
Indictment states that [Elias] had 
exchanged emails about the [Alfa 
Bank] allegations with the Clinton 
Campaign’s campaign manager, 
communications director, and foreign 
policy advisor which the defendant 
had provided to a newspaper. Ind. 4 
25(e). Indeed, the government also 
provided the true identities of each of 
those referenced individuals to 
defense counsel in a discovery letter 
dated October 20, 2021. Likewise, 
Paragraphs 20(d) and 20(g) allege that 
the defendant, one of his law partners, 
and [Rodney Joffe] each 
communicated via email with an 
investigative firm that was at the time 
acting as an agent of the Clinton 
Campaign. The government similarly 
has provided the identity of that 
investigative firm to the defense in its 
October 20 discovery letter, even 
though counsel was undoubtedly 
already aware of that firm’s identity. 
Moreover, it was a production of 
information by the defendant’s counsel 
(i.e., a privilege log) that first alerted 
the government to these cited emails. 
Accordingly, the defendant is neither 
entitled to, nor needs any greater 
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prior to trial. At bottom, the 
defendant’s demand here is not an 
appropriate use of a motion for a bill 
of particulars and should be denied. 


In response to the request for the identities of the 
Clinton Campaign people he was coordinating with, 


Durham pointed to the following allegations: 


d. In or around the same time period 
[mid-August 2016], SUSSMANN, [Marc 
Elias], and personnel from [Fusion 
GPS] began exchanging emails with 
the subject line, “Connecting you all 
by email.” 


[snip] 


g. Later in or about August 2016, 
[Rodney Joffe] exchanged emails with 
personnel from [Fusion GPS]. 


[snip] 


e. On or about September 15, 2016, 
[Elias] exchanged emails with the 
Clinton Campaign’s campaign 
manager, communications director, 
and foreign policy advisor concerning 
the [Alfa Bank] allegations 

that SUSSMANN had recently shared 
with [Franklin Foer]. [Elias] billed his 
time for this correspondence to the 
Clinton Campaign with the billing 
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That is, in response to a question, tell me what 
agents of the Clinton Campaign Sussmann and Joffe 
and Perkins Coie coordinated with, which is 
something (Durham claims) Sussmann lied to hide, 
Durham responded by pointing to 1) an email where 
Elias connected Fusion GPS and Sussmann via email 
(well after the identification of the Alfa Bank 
anomaly), 2) emails that Joffe exchanged with 
Fusion GPS, and 3) an email that Elias sent Jake 


Sullivan and others about the Franklin Foer article. 


Effectively, Durham’s response admits that he has 
presented no evidence either Sussmann or Joffe ever 
spoke directly to members of the Clinton Campaign 
about the Alfa Bank allegations. He sustains the 
claim only by raising Elias, whom he doesn’t mention 


in that materiality statement. 


He also admits that he is treating Fusion GPS as an 
agent of the Clinton Campaign, which it arguably is, 
but only through Perkins Coie. The indictment 
presents no evidence that the Campaign was directly 
managing Fusion, or even aware of it. There’s no 
place in this indictment where the Clinton Campaign 
provided directions into this effort that would 
amount to an instruction to feed information to the 
FBI, something that goes to the heart of whether or 
not Sussmann was representing Hillary at the 
meeting with Baker. (Right wing conspiracists have, 


in recent days, pointed back to Sussmann’s June 


Oo emptywheel 


Durham might not even have the content of his 
emails with Fusion GPS or Elias’ emails with Sullivan 
and others. He only knows of these communications, 
Durham explains, because Sussmann invoked 
privilege over them in a privilege log shared with 


Durham. 


In the indictment, Durham makes much of 
something April Lorenzen (the security expert who 
used the name Tea Leaves during this project but 
whom Durham has needlessly referred to as 
Originator-1) said on August 20, 2016 that reflects an 
obvious technical point: “even if we found what 
[Joffe] asks us to find in DNS, we don’t see the 
money flow, and we don’t see the content of some 
message Saying, ‘send money here’.” That is, the DNS 
traffic they were following was proof of some kind of 
messaging. But it was not proof of what was being 
said. Durham may have the same problem: he may 
not have proof regarding what direction these 


communications flowed and what was really said. 


| would not be remotely surprised if Durham used 
the fact that he obtained a false statements 
indictment as a basis to obtain a probable cause 
warrant to obtain these communications via other 
means (perhaps via whatever company hosts Perkins 
Coie’s email) such that an FBI filter team could do 
their own privilege determination of them. Durham 
is working on a theory that this is all two parallel 


conspiracies to defraud the government, and would 


0. emptywheel 


scrutiny as Trump (as if the Clinton email and Clinton 
Foundation investigations didn’t already do that), 
and Trump’s attorneys keep having their 
communications seized. So I’m sure Durham would 
relish seizing the communications of Elias and 


Sussmann. 


That said, for the existing indictment charging only 
Sussmann with a single false statement, Durham 
claims that Sussmann lied to James Baker by 
disclaiming that both his work to chase down this 
Alfa Bank anomaly and his scheduling of a meeting 
at which he gave Baker a heads up that a media 
outlet was going to publish the story in order to hide 
that he was “coordinating” with the Clinton 
Campaign. But Durham presents no evidence 
Sussmann ever spoke to anyone at the Clinton 
Campaign on this topic ... and the only evidence he 
presents that anyone spoke to Hillary’s people 
comes well after the white papers provided to the 


FBI were substantially complete. 


This doesn’t really fly in an indictment charging just 
Sussmann. It effectively treats this as a conspiracy, 
without (yet) charging a conspiracy. With his 
response to Sussmann’s motion for a Bill of 
Particulars, Durham has effectively accused and 
treated all the named people of engaging in a 
conspiracy without showing any evidence that they 


were doing anything other than trying to understand 
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michael-sussmann-materiality-statement/? 
print=pdf] 


i. 
[https://www.emptywheel.net/2021/10/21/john- 
durham-admits-he-overstated-evidence-in-his- 
michael-sussmann-materiality-statement/? 


print=print] 


Tags: James Baker, John Durham, Marc Elias, Michael 


Sussmann 


REPLIES 


P J Evans 
October 21, 2021 at 10:54 am 


| really hope the court looks at this and laughs 


Durham out. 


PhonelnducedPinkEye 
October 21, 2021 at 11:28 am 


At some point it’s the responsibility of 
the Biden DOJ to send him home to 
strain meals through his moustache 
like krill in front of his family, or do 


what EW suggested and start an 


